Grouping and Aggregation Approximate Query Processing Method under Local Differential Privacy
By employing a two-stage mechanism and a group distribution-based perturbation mechanism (GDP), the problem of uneven error and insufficient accuracy in group aggregation queries under local differential privacy is solved, achieving efficient and accurate group aggregation queries while meeting privacy protection requirements.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- GUANGZHOU UNIVERSITY
- Filing Date
- 2026-03-16
- Publication Date
- 2026-05-26
AI Technical Summary
Existing technologies for implementing grouped aggregation approximate query processing under local differential privacy conditions suffer from problems such as difficulty in balancing grouping errors, insufficient accuracy of query results, and difficulty in balancing query efficiency and privacy protection requirements.
A two-stage mechanism is adopted: the first stage optimizes the sampling rate by using the group distribution to maintain the perturbation mechanism GDP for local perturbation and unbiased estimation; the second stage performs adaptive sampling by using the PCKV-GRR mechanism for data uploading and dynamically allocating the sampling rate to balance the error.
It improves the accuracy and efficiency of grouped aggregation queries, reduces computational overhead, achieves error balancing and privacy protection, preserves the statistical characteristics of grouping, and provides unbiased estimates of frequency, mean, and variance.
Smart Images
Figure CN121858640B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of approximate query processing and privacy protection, specifically to a grouped aggregation query processing method that combines sampling-based approximate query processing with local differential privacy. Background Technology
[0002] With the development of big data technology, grouping and aggregation queries, as a fundamental query form in databases and data analysis systems, are widely used in statistical analysis, data mining, and other scenarios, where computational efficiency is crucial. Sampling-based approximate query processing is widely used to address this issue, estimating the aggregation result by using a small subset of the data instead of the entire dataset. While this method improves processing efficiency and supports timely analysis, it also introduces privacy risks when handling sensitive information. In applications involving sensitive user data, directly performing grouping and aggregation queries on the raw data may lead to user privacy leaks; therefore, privacy protection mechanisms are needed to constrain the data query process.
[0003] Local Differential Privacy (LDP), an important privacy protection technology, allows users to randomly perturb data locally during the data collection phase, ensuring privacy requirements are met even in untrusted environments. It has been widely studied in the field of privacy-preserving data analysis in recent years. Under LDP constraints, the server cannot obtain the actual data and can only perform statistical analysis based on the perturbed data uploaded by the user, thus increasing the uncertainty of query results. Although LDP inevitably introduces noise errors, many query analysis tasks under LDP do not require precise results but allow for approximate results with controllable errors. Sampling-based approximate query processing aims to significantly improve query efficiency while sacrificing controllable result accuracy. Therefore, combining LDP with approximate query processing can improve query efficiency and result usability while protecting privacy.
[0004] However, existing technologies have the following problems when implementing grouped aggregation approximate query processing under local differential privacy conditions:
[0005] On the one hand, existing sampling estimation methods under local differential privacy struggle to achieve an effective balance of errors across different groups. Because the impact of sampling error and privacy noise differs across groups, existing methods often fail to simultaneously minimize both sampling error and local differential privacy noise, resulting in uneven estimation accuracy across different groups and poor overall query result stability.
[0006] On the other hand, most existing approximate query processing methods assume that the server can directly access the original data, which is difficult to apply directly to local differential privacy environments. Furthermore, existing research has shown that allocating sample size according to the coefficient of variation of each group can balance the relative error, but the estimation of the coefficient of variation requires frequency, mean and variance information. Existing key-value data collection mechanisms under local differential privacy only focus on the frequency of keys and the mean of values, and the reusability of other statistical data is insufficient, making it difficult to meet the needs of grouped aggregation queries.
[0007] In summary, existing technologies for implementing grouped aggregation approximate query processing under local differential privacy conditions generally suffer from problems such as difficulty in balancing grouping errors, insufficient accuracy of query results, and difficulty in balancing query efficiency and privacy protection requirements. There is still a lack of a solution that can effectively integrate approximate query processing technology to improve the efficiency and accuracy of grouped aggregation queries while ensuring privacy protection. Summary of the Invention
[0008] To address the shortcomings of existing technologies in performing grouped aggregation approximate query processing under local differential privacy, the present invention aims to provide a grouped aggregation approximate query processing method under local differential privacy, which can effectively integrate sampling-based approximate query processing technology while satisfying local differential privacy protection, thereby improving the efficiency and accuracy of grouped aggregation queries.
[0009] To achieve the above objectives, the present invention adopts the following technical solution: a grouping and aggregation approximate query processing method under local differential privacy, comprising two stages: stage one: sampling rate optimization stage and stage two: grouping and aggregation approximate query processing stage, the specific steps of which are as follows:
[0010] Phase 1: Sampling Rate Optimization Phase
[0011] S1: Set the total sampling budget to s, and the segmentation factor to... ,in Divide the user set U into a first user subset U1 and a second user subset U2, where the number of users in the first user subset U1 is... ;
[0012] S2: Uniform sampling from user set U Each user is designated as the first user subset U1;
[0013] S3: For each user in the first user subset U1, the group distribution maintains perturbation mechanism GDP is used to locally perturb its group attribute value and aggregate attribute value, and the perturbed data is uploaded to the server;
[0014] S4: Based on the received perturbation data, the server uses the perturbation parameters of the GDP mechanism to make unbiased estimates of the frequency, mean, and variance of each group.
[0015] S5: The server calculates the error composite coefficient based on the estimated statistics of each group. And based on the error comprehensive coefficient, the optimal sample size and optimal sampling rate for each group are calculated;
[0016] Phase Two: Grouping and Aggregation Approximate Query Processing Phase
[0017] S6: Each user in the second user subset U2 uses the PCKV-GRR key-value perturbation mechanism to locally perturb its grouping attribute value and aggregation attribute value;
[0018] S7: Based on the optimal sampling rate of each group calculated in step S5, adaptive sampling is performed on the perturbed user data. Each user decides whether to upload data based on the sampling rate of the group to which they belong after the perturbed data.
[0019] S8: The server estimates and outputs the aggregate query results for each group based on the sampled perturbation data set.
[0020] Furthermore, the segmentation factor The range of values is The sampling budget for Phase 1 is The sampling budget for Phase Two is Since Phase 1 only requires a rough estimate of the statistical values of each group, a smaller sample size is allocated; Phase 2 performs precise aggregation based on the optimal sampling rate of Phase 1, allocating the remaining sampling budget.
[0021] Furthermore, the specific process of the grouped distribution perturbation mechanism GDP described in step S3 is as follows:
[0022] For a user's grouping attribute value g and aggregate attribute value v, the aggregate attribute value v is first standardized to the interval [0,1] to form value pairs. .
[0023] The perturbation method for the grouped attribute value gg is: to keep the original value unchanged with probability a, that is... ; where the probability perturbation c is any other value in the grouping attribute range. Where:
[0024] (1)
[0025] in, The privacy budget for the grouping attribute is given by d, where d is the size of the range of values for the grouping attribute; this can be verified. That is, the probability distribution satisfies the normalization condition.
[0026] The perturbation method for the aggregate attribute value v is divided into two cases based on the perturbation result of the grouped attributes:
[0027] Scenario 1: When the grouping attribute value remains unchanged First, normalize the probability. From the interval A value is randomly selected uniformly as the perturbation value. or normalized probability From the interval A value is randomly selected uniformly as the perturbation value. ;
[0028] Scenario 2: When the grouping attribute value changes A value is randomly selected from the uniform distribution U(-b, 1+b) as the perturbation value. ;
[0029] The perturbation parameter b is the optimal value obtained by optimizing the privacy-utility tradeoff, and its calculation formula is as follows:
[0030] (2)
[0031] The formulas for calculating the perturbation weights p′p′ and q′q′ are as follows:
[0032] (3)
[0033] in, For the privacy budget of aggregated attributes; p′p′ and q′q′ are perturbation weights (not direct probabilities), and the probability is calculated by normalizing the weights during actual perturbation, i.e., perturbation to the interval. The probability is Disturbance to the interval The probability is .
[0034] The core innovation of the GDP mechanism lies in the fact that by perturbing the aggregated attribute values into values within a continuous interval (rather than two discrete endpoints), the statistical characteristics of the aggregated value distribution are preserved, enabling the server to simultaneously estimate the frequency, mean, and variance based on the perturbed data, thus providing a basis for subsequent error equalization sampling rate allocation.
[0035] Furthermore, the estimation methods for the group statistics in step S4 are as follows:
[0036] The total number of samples collected in this phase is [number missing]. For each perturbation data set, the statistical observation frequency is calculated for the i-th group. Observed mean and observation variance .
[0037] The frequency estimate for the i-th group is:
[0038] (4)
[0039] The formula uses the perturbation probabilities a and c of the GDP mechanism to perform unbiased correction on the observation frequency, thereby eliminating the bias caused by the perturbation of group attributes. a and c are calculated by equation (1).
[0040] The mean estimate for group i is:
[0041] (5)
[0042] This formula comprehensively considers the effects of grouping attribute perturbations (parameters a, c) and aggregation attribute perturbations (parameters b, p′, q′) to achieve an unbiased estimate of the mean. In the formula: the first term... The expected sum of the observed i-th aggregate values; the second term The impact of users not in group i being incorrectly perturbed to group i has been corrected; the third term The perturbation of the aggregate value of the i-th user group was corrected. The impact of intervals.
[0043] The variance estimate for group i is:
[0044] (6)
[0045] This formula is based on the second-order moment estimation principle, by estimating E[v] 2 Subtract again The variance estimate is obtained. The physical meaning of each term in the formula is similar to that of the mean estimate, respectively correcting for the second-order moment bias caused by grouping perturbation and aggregate value perturbation.
[0046] Furthermore, the method for calculating the optimal sample size for each group in step S5 is as follows:
[0047] This invention uses an error comprehensive coefficient To achieve effective error balancing between different groups, The impact of sampling error and LDP noise error on the estimation accuracy of each group was comprehensively considered.
[0048] First, calculate the standardized mean of the i-th group. and standardized variance :
[0049] , = (7)
[0050] in, , The results are obtained from equations (5) and (6) respectively.
[0051] Calculate the expected number of observed users in the i-th group:
[0052] (8)
[0053] in, The number of sampled users in Phase 1 (i.e. ), The estimated frequency for group i is calculated using equation (4). This formula indicates that the observed users in group i consist of two parts—users who truly belong to group i and whose proportion remains constant (the proportion is...). (and users who do not belong to group i but have been disturbed to group i) and users who are not in group i but have been disturbed to group i (the proportion is) ).
[0054] Calculate the error comprehensive coefficient of group i. :
[0055] (9)
[0056] Where p is the aggregate property perturbation parameter of the PCKV-GRR mechanism, which is calculated by equation (12). It consists of three parts: the first item This indicates the impact of sampling error on variance estimation; the second term Indicates the effect of LDP noise on the aggregation property; the third term This indicates the impact of LDP noise on grouping attributes.
[0057] The optimal sample size for group i is:
[0058] (10)
[0059] in, Let g be the sampling budget for Phase Two, and g be the total number of groups. The design principle of this formula is: for the error coefficient... Larger (i.e., more difficult to estimate), and a larger number of observation users. Larger (i.e., the group has a large number of users), standardized mean Smaller groups (i.e., those requiring higher relative precision) are allocated a larger sample size.
[0060] The optimal sampling rate for group i for:
[0061] (11)
[0062] in, Calculated from equation (10), It is calculated from equation (8).
[0063] Furthermore, the PCKV-GRR key-value perturbation mechanism described in step S6 is an existing LDP key-value data collection mechanism, and its parameters are defined as follows:
[0064] The perturbation parameters for grouped attributes are consistent with those in equation (1);
[0065] Aggregate attribute perturbation parameters:
[0066] (12)
[0067] in, and Here, represents the privacy budget for the grouping attribute and the aggregation attribute, respectively, and d is the range of the grouping attribute; the PCKV-GRR mechanism separates user grouping-value pairs. Disturbance is .
[0068] Furthermore, the specific method of adaptive sampling in step S7 is as follows: for users in the second user subset U2 who belong to the i-th group after perturbation, the sampling rate is... The probability determines whether to upload the perturbed group-value pairs to the server.
[0069] It is important to note that Phase Two employs a "perturb first, sample later" strategy. This means that all users first complete their local perturbation, and then the decision to upload is based on the optimal sampling rate. The purpose of this strategy is to prevent privacy breaches related to the sampling rate—if sampling is performed before perturbation, the sampling rate itself might leak statistical information about the groups.
[0070] Compared with the prior art, the beneficial effects of the present invention are:
[0071] 1. Improve the accuracy and efficiency of LDP grouping and aggregation queries: Through a two-stage optimized sampling rate allocation mechanism, the accuracy of query results can be significantly improved while reducing the computational overhead in the sampling process and improving query efficiency, while satisfying local differential privacy protection.
[0072] 2. Effectively balances errors between different groups: This invention uses an error comprehensive coefficient By comprehensively considering sampling error and LDP noise error, and dynamically allocating the sampling rate accordingly, the problem of error imbalance in existing LDP downsampling technology is solved. It can effectively balance the error between different groups, thereby improving the stability and usability of the overall query results.
[0073] 3. Preserving statistical characteristics while ensuring privacy: By adopting a grouped distribution to maintain the perturbation mechanism GDP, this invention can effectively preserve the statistical characteristics (frequency, mean, variance) of the group while meeting the local differential privacy protection requirements, thus reducing the negative impact of perturbation on query accuracy.
[0074] 4. Achieve joint unbiased estimation of frequency, mean, and variance: The GDP mechanism, through continuous interval perturbation design, has for the first time achieved joint unbiased estimation of grouped statistics under LDP, providing a reliable basis for sampling rate optimization based on the coefficient of variation. Attached Figure Description
[0075] Figure 1 This is a framework diagram of LDPGroupBy of the present invention;
[0076] Figure 2 The flowchart is for the grouped distribution perturbation mechanism (GDP) of the present invention. Detailed Implementation
[0077] The technical solution of the present invention will now be clearly and completely described with reference to the embodiments and accompanying drawings. Obviously, the described embodiments are merely preferred embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.
[0078] Example 1: Implementation of a General Scenario
[0079] like Figure 1 As shown, this invention provides a grouping aggregation approximate query processing method under local differential privacy, which is implemented using a two-stage mechanism: the first stage focuses on uniformly sampling from all users to estimate the statistics of each group, and calculates the optimal sample size allocation strategy for the second stage based on these estimates; the second stage optimizes the grouping aggregation results based on the optimal sample allocation strategy established in the first stage.
[0080] Parameter settings
[0081] The following parameters are set in this embodiment:
[0082] Total sampling budget: s=10000;
[0083] Segmentation factor: α = 0.2 (i.e., Phase 1 uses 20% of the sampling budget);
[0084] Grouping attribute privacy budget: ;
[0085] Aggregate attribute privacy budget: ;
[0086] Grouping attribute value range size: d=10 (assuming there are 10 groups);
[0087] Total number of users: |U| = 100,000.
[0088] Phase 1: Sampling Rate Optimization Phase
[0089] Step S1: Based on the parameter settings, the sampling budget for Phase 1 is... Phase 2 sampling budget is Divide the user set U into U1 (|U1|=2000) and U2 (|U2|=|U|-2000).
[0090] Step S2: Randomly sample 2000 users from the user set U to form the first user subset U1.
[0091] Step S3: As Figure 2 As shown, each user in U1 uses the GDP mechanism for local perturbation. First, the perturbation parameters of the GDP mechanism are calculated:
[0092] Grouping attribute perturbation parameters (based on) (d=10), from equation (1) we can obtain:
[0093]
[0094]
[0095] Aggregate attribute perturbation parameters (based on) From equation (2), we can obtain:
[0096]
[0097] From equation (3), the perturbation weights p′ and q′ can be obtained:
[0098]
[0099]
[0100]
[0101] Important note: p′ and q′ are perturbation weights (not direct probability values). The actual perturbation probability needs to be calculated using weight normalization, which can be obtained from the normalization rules of the GDP mechanism:
[0102]
[0103]
[0104] Each user is perturbed according to the following rules:
[0105] Grouping attribute g: remains unchanged with probability 0.23197, and is perturbed to one of the other 9 grouping values with probability 0.08534;
[0106] Aggregate attribute v (normalized to [0,1]): If g remains unchanged, it takes a uniform value from [v-0.12930,v+0.12930] with a probability of 0.88079, and a uniform value from [-0.12930,v-0.12930]∪[v+0.12930,1.12930] with a probability of 0.11921; if g changes, it takes a uniform value from U(-0.12930,1.12930).
[0107] Step S4: After receiving 2000 disturbance data, the server calculates the observation frequency, observation mean and observation variance by group, and then uses equations (4), (5) and (6) to perform unbiased estimation.
[0108] Assume the observation data for group 1 are as follows: , , From equation (4), the frequency estimate of the first group can be obtained:
[0109]
[0110] The mean and variance estimates for Group 1 can be calculated by substituting the values into equations (5) and (6) (the specific numerical calculation process is omitted here).
[0111] Step S5: Calculate the error comprehensive coefficient based on the estimated statistics of each group. and optimal sample size .
[0112] First, calculate the aggregate property parameters of PCKV-GRR. (for) (Calculation), from equation (12) we can obtain:
[0113]
[0114] Taking Group 1 as an example, assuming that after correction , , = =0.2:
[0115] The number of observed users is calculated using equation (8):
[0116]
[0117] The error comprehensive coefficient is calculated using equation (9). :
[0118]
[0119] Substitute the values:
[0120]
[0121] Calculate all groups , , Then, the sample size allocation for each group is calculated using equation (10):
[0122]
[0123] The optimal sampling rate can be obtained from equation (11): .
[0124] Phase Two: Grouping and Aggregation Approximate Query Processing Phase
[0125] Step S6: Each user in the second user subset U2 performs local perturbation using the PCKV-GRR mechanism. The PCKV-GRR parameters can be obtained from equations (1) and (12):
[0126] , .
[0127] , .
[0128] Step S7: Perform adaptive sampling on the perturbed users. Assume the optimal sampling rate for group 1 is... If the disturbance occurs, users belonging to Group 1 will have a 40% probability of uploading their data.
[0129] Step S8: The server estimates the aggregate query results of each group based on the sampled data and completes the grouped aggregate approximate query processing.
[0130] Example 2: Application of Medical Data Analysis
[0131] Suppose a medical data analysis platform needs to perform grouped and aggregated queries based on patients' disease types (grouping attribute, d=10 diseases) to calculate the average treatment cost (aggregation attribute) for each disease. Both patient disease types and treatment costs are sensitive data, and the queries must be completed while protecting privacy.
[0132] Parameter settings
[0133] Total sampling budget: s=5000;
[0134] Segmentation factor: α = 0.2;
[0135] Privacy Budget: (Disease type) (Treatment costs);
[0136] Total number of patients: |U| = 50,000.
[0137] Step 1: Data Collection and Statistical Estimation
[0138] 1000 patients were randomly sampled from 50,000 patients. Each sampled patient uploads their data locally after perturbing the disease type and treatment cost (normalized to [0,1][0,1]) using the GDP mechanism. The parameters of the GDP mechanism are calculated using equations (1), (2), and (3).
[0139] After receiving 1000 perturbation data points, the server groups them according to the disease type after the perturbation and calculates the observation frequency of each group. ; Calculate the observed mean cost of perturbation treatment for each group. and observation variance Unbiased corrections are performed on frequency, mean, and variance using equations (4), (5), and (6).
[0140] Step 2: Calculation of the optimal sampling rate
[0141] Based on the estimated statistics, the standardized mean of each disease type group is calculated sequentially using equations (7), (8), and (9). Standardized variance Number of observed users Error comprehensive coefficient Then, the optimal sample size is calculated using equations (10) and (11). and optimal sampling rate .
[0142] For disease types with a large number of patients and a high coefficient of variation in treatment costs (such as cancer), a higher sampling rate is assigned; for disease types with a small number of patients and relatively stable treatment costs (such as the common cold), a lower sampling rate is assigned.
[0143] Step 3: Phase Two Sampling and Aggregation Query
[0144] For each of the remaining 49,000 patients: 1. Local perturbation of disease type and treatment cost using the PCKV-GRR mechanism, with PCKV-GRR parameters calculated from equations (1) and (12); 2. Sampling rate based on the perturbation disease type. With probability Decide whether to upload the data.
[0145] The server collected approximately 4,000 sampling data points. Estimate the average treatment cost for each disease type and output the results.
[0146] Effect Analysis
[0147] Compared with existing methods, the advantages of this invention are as follows:
[0148] Error equalization: through The driving sampling rate allocation makes the relative estimation errors of each disease type tend to be balanced, avoiding the problem of excessive grouping errors;
[0149] Privacy protection: Satisfies all needs throughout the process -Local differential privacy ensures that the patient's raw data does not leave the local area;
[0150] Efficiency improvement: Only 5000 / 50000=10% of users need to be sampled, significantly reducing communication and computing overhead;
[0151] Accuracy Guarantee: The GDP mechanism preserves distribution information, statistical estimates are unbiased, and aggregation results are reliable.
[0152] This technology is suitable for large-scale grouping and aggregation analysis scenarios involving sensitive data, such as those in the medical, financial, and e-commerce sectors.
[0153] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A method for processing grouped aggregate approximate query under local differential privacy, characterized in that, Includes the following steps: Phase 1: Sampling Rate Optimization Phase S1: Set the total sampling budget to s, and the segmentation factor to... ,in Divide the user set U into a first user subset U1 and a second user subset U2, where the number of users in the first user subset U1 is... ; S2: Uniform sampling from user set U Each user is designated as the first user subset U1; S3: For each user in the first user subset U1, the group distribution maintains perturbation mechanism GDP is used to locally perturb its group attribute value and aggregate attribute value, and the perturbed data is uploaded to the server; the group distribution maintains perturbation mechanism GDP mentioned in step S3 includes: For a user's grouping attribute value g and aggregate attribute value v, the aggregate attribute value v is standardized to the interval [0,1] to form value pairs. ; The perturbation method for the grouped attribute value g is: to keep the original value unchanged with probability a, that is... ; let the probability perturbation c be any other value in the grouping attribute range; where: (1) in, Here, d represents the privacy budget for the grouping attribute, and d represents the size of the value range of the grouping attribute. The perturbation method for the aggregate attribute value v is as follows: When the grouping attribute value remains unchanged, that is First, normalize the probability. From the interval A value is randomly selected uniformly as the perturbation value. or normalized probability From the interval A value is randomly selected uniformly as the perturbation value. ; When the grouping attribute value changes, that is... From uniform distribution A value is randomly selected as the perturbation value. ; The formulas for calculating the perturbation parameter b and the perturbation weights p′ and q′ are as follows: (2) (3) in, For the privacy budget of the aggregated attributes; p′ and q′ are the perturbation weights, and the actual perturbation probability is calculated by normalizing the weights; S4: Based on the received perturbation data, the server uses the perturbation parameters of the GDP mechanism to make unbiased estimates of the frequency, mean, and variance of each group. S5: The server calculates the error composite coefficient based on the estimated statistics of each group. And based on the error comprehensive coefficient, the optimal sample size and optimal sampling rate for each group are calculated; Phase Two: Grouping and Aggregation Approximate Query Processing Phase S6: Each user in the second user subset U2 uses the PCKV-GRR key-value perturbation mechanism to locally perturb its grouping attribute value and aggregation attribute value; S7: Based on the optimal sampling rate of each group calculated in step S5, adaptive sampling is performed on the perturbed user data. Each user decides whether to upload data based on the sampling rate of the group to which they belong after the perturbed data. S8: The server estimates and outputs the aggregate query results for each group based on the sampled perturbation data set.
2. The grouping and aggregation approximate query processing method under local differential privacy according to claim 1, characterized in that, The dividing factor The range of values is The sampling budget for Phase 1 is The sampling budget for Phase Two is .
3. The grouping and aggregation approximate query processing method under local differential privacy according to claim 1, characterized in that, The estimation method for each group statistic in step S4 is as follows: The frequency estimate for the i-th group is: (4) The mean estimate for group i is: (5) The variance estimate for group i is: (6) in, , , , respectively, are the observation frequency, observation mean and observation variance of the i-th group; a and c are the group attribute perturbation probabilities, calculated by equation (1); p′, q′ and b are the aggregate attribute perturbation parameters, calculated by equations (2) and (3).
4. The grouping aggregation approximate query processing method under local differential privacy according to claim 3, characterized in that, The method for calculating the optimal sample size for each group in step S5 is as follows: First, the standardized mean M of the i-th group is calculated i and the standardized variance V i : , = (7) Calculate the number of observation users in the i-th group: (8) in, The number of users sampled in Phase 1. The estimated frequency of the i-th group is calculated by equation (4); Calculate the error comprehensive coefficient of group i. : (9) Where p is the aggregate property perturbation parameter of the PCKV-GRR mechanism; The optimal sample size for group i is: (10) in, Let g be the sampling budget for Phase 2, and g be the total number of groups.
5. The grouping and aggregation approximate query processing method under local differential privacy according to claim 4, characterized in that, The optimal sampling rate for group i The calculation formula is: (11) in, The optimal sample size for the i-th group is calculated using equation (10); The number of observation users in the i-th group is calculated using equation (8).
6. The grouping aggregation approximate query processing method under local differential privacy according to claim 1, characterized in that, The parameters of the PCKV-GRR key perturbation mechanism described in step S6 are defined as follows: The perturbation parameters for grouped attributes are consistent with those in equation (1); Aggregate attribute perturbation parameters: (12) in, Privacy budgets for grouping attributes and aggregation attributes, respectively; User grouping-value pairs After PCKV-GRR perturbation, the following was obtained .
7. The grouping and aggregation approximate query processing method under local differential privacy according to claim 5, characterized in that, The specific method of adaptive sampling in step S7 is as follows: For users in the second user subset U2 who belong to the i-th group after perturbation, at the sampling rate The probability determines whether to upload the perturbed group-value pairs to the server. It is calculated from equation (11).
8. The grouping and aggregation approximate query processing method under local differential privacy according to claim 1, characterized in that, The grouped distribution perturbation mechanism GDP ensures that the distribution information of aggregated attribute values can be estimated by perturbing the aggregated attribute values into values within a continuous interval rather than discrete points, thereby achieving a joint unbiased estimation of frequency, mean, and variance.
9. The grouping and aggregation approximate query processing method under local differential privacy according to claim 1, characterized in that, Step S6 adopts a perturbation-then-sampling strategy, that is, all users in the second user subset U2 first complete local perturbation, and then sample according to the optimal sampling rate, so as to avoid privacy leakage due to sampling rate.